ProjectSend version r561 suffers from cross site request forgery, cross site scripting, and remote shell upload vulnerabilities.